Distributed port-blocking method

ABSTRACT

A method of managing connectivity between an end-device and one of a plurality of bridging-devices connected to the end-device. The method includes transmitting test messages by each of the bridging-devices, transmitting test messages by the end-device, determining, in each of the bridging-devices, with which of the other devices there is an operative connection, based on the test messages the bridging-device receives and determining, in each of the bridging-devices, whether a port leading to the end-device should be in a forwarding or blocking state responsive to the determination of the operative connections.

RELATED APPLICATIONS

This application is a divisional of pending U.S. application Ser. No.09/535,987, filed Mar. 27, 2000, which is a continuation-in-part ofpending U.S. application Ser. No. 09/061,484, filed Apr. 16, 1998, thedisclosures of which are incorporated by reference herein.

FIELD OF THE INVENTION

The present invention relates to communication networks and inparticular to local area networks with redundancy.

BACKGROUND OF THE INVENTION

Generally, local area networks are used to connect a plurality ofend-stations, e.g., computers, to each other and/or to one or moregateways which lead to wide area networks. In many cases the connectionsof the end-stations to each other and/or to a wide area network are veryimportant and should not fail even for a few seconds. For example, thedisconnection, even for a short period, of some Internet, banking,telephone and stock market servers may have severe economicalconsequences.

Local area networks generally comprise a plurality of bridging-devices(e.g., Ethernet switches, switch modules, bridges) and communicationlinks. Each communication link connects between two or morebridging-devices or between one or more bridging-devices and one or moreend-stations. Each bridging-device comprises a plurality of ports whichserve as interfaces between the bridging-device and the links to whichit is connected. As with other complex devices, bridging-devices andcommunication links may fail. Usually, the chances of a failureoccurring increase with the complexity of the device.

The data passed through local area networks is generally packaged inframes (also referred to as packets), commonly having a length of up toabout 1522 bytes. Many frames transmitted through local area networksare broadcast frames which are sent to most or substantially all thebridging-devices of the network. In the present application, broadcastframes refer to any frames distributed throughout a network, includingframes which carry broadcast and multicast addresses and frames whichcarry addresses which are not recognized by the bridging-devices of thenetwork. A commonly used broadcast scheme involves having abridging-device, that receives a broadcast frame, forward the framethrough all its ports, except the port through which the frame wasreceived, and in some cases except ports especially defined as leadingto devices not desiring to receive the frame. This broadcast schemeoperates properly only if the ports and links do not form a loop in thenetwork. If the network includes a loop of ports, a single frame may berepeatedly forwarded through the network and the network will fail. Sucha situation is commonly referred to as a broadcast storm.

In many cases redundant links are added to networks, to be used in caseone or more of the bridging-devices and/or links fail. A spanning treealgorithm (STA) is commonly used to block the ports leading to theredundant links and thus prevent the formation of loops. A blocking port(also referred to as a port in a blocked state, or as a blocked port)only sends and receives specific control frames (i.e., frames having thestandard STA BPDU-address, as their destination address) and does notforward data frames at all. Usually, bridging-devices, which are resetor begin to operate, initially block all their ports. Then, the STAactivates those ports which are to be used for forwarding data.

One common spanning tree algorithm is the 802.1D standard spanning treealgorithm (STA) which is described in “Informationtechnology—Telecommunications and information exchange betweensystems—Local and metropolitan area networks—Media access control (MAC)bridges”, International Standard ISO/IEC 15802-3, 1998, ANSI/IEEE Std802.1D, 1998 edition, the disclosure of which is incorporated herein byreference. Faster STAs are described in “Speedy Tree Protocol” and“Truncating Tree Timing”, both of which are by M. Seaman, IEEE 802.1interim meeting, January 1999. Even these faster STAs require a fewseconds to converge.

In some networks described, for example, in a white paper by OriBendori, titled “Lucent product support”, and available at/www.lannet.com/site/products/white/safwp-05.htm, the disclosure ofwhich is incorporated herein by reference, redundant links are handledlocally by a single bridging-device, rather than by using an STA whichis a distributed algorithm and is relatively complex. Thebridging-device includes active ports and blocked ports. When a failureoccurs in one of the active ports, a hardware indication is provided tothe bridging-device which automatically activates a predetermined one ofthe blocked ports, and blocks the inoperative port. Thus, the failure isovercome relatively quickly.

Some end-station devices, however, such as telephony switchboards,include only a single external port with which they connect to a localarea network. In order to ensure continuous connection of theend-station to the network, the end-station is connected to a pluralityof bridging-devices through an Ethernet repeater, under the assumptionthat simple repeaters fail much more rarely than bridging-devices, whichare relatively complex. In such a configuration it is not possible touse the method described in the Ori Bendori paper, as a single portconnects the end-station to the bridging-devices. Therefore, theblocking must be performed by the plurality of bridging-devicescooperatively and not by a single device. In other cases it may bedesired that the blocking be performed by the bridging-devices even whenthe end-station has more than one port. For example, in some cases it isnot practical to change the end-station devices to operate in accordancewith special, fast, port blocking methods.

In some cases a failure of a device or link may be partial, for example,a link may operate only in one direction and not in the other direction.Existing blocking methods do not always detect such partial failures.There are links which perform hardware tests in both directions beforereporting that the link is operative. These hardware tests, however, donot catch all the possible problems which could cause the connectionbetween two devices to be inoperative. Thus, in some cases messages arenot properly transmitted from one bridging-device to the other althoughthe hardware indicates the link is operative. Using the indications ofthe hardware may result in wrong operation of the STA in activating aport which should be blocked, which may cause a broadcast storm, or inblocking a port which should be active which results in a networkdisconnection.

A trivial solution involves sending hello messages between twobridging-devices of a network connected by a link, and determining theoperability of the link based on whether the hello messages arereceived. This solution can be used on a link connecting only the twobridging-devices which transmit the hello messages or on a linkconnecting additional devices, for example, on a link connecting twobridging-devices and an end-station. The determination of theoperability of the link may be performed based solely on the receptionof the hello messages or based on a combination of the reception of thehello messages and on hardware indications. According to the operabilitydetermination the bridging-devices decide whether to block or activatetheir port to the link. This solution, however, has a few drawbacks. Forexample, if both the bridging-devices do not receive hello messages fromeach other due to a fault in the link, and the hardware does not detectthe fault, both the bridging-devices may assume the otherbridging-device is faulty and activate their ports. When the faultdisappears a loop is formed and the network may suffer from a broadcaststorm.

A broadcast storm may also result if a link operates only in onedirection and the problem is not identified by the hardware.

Generally, STAs and other port blocking schemes define a primarytopology which is active when the devices of the network are operative.When a failure occurs, the network reverts to a backup topology. Whenthe failure is overcome, the network returns to the primary topology.This, however, causes an extra, unnecessary, switch of the network whichinterrupts the data flow in the network.

SUMMARY OF THE INVENTION

One aspect of some preferred embodiments of the present inventionrelates to a distributed port-blocking method for a plurality ofbridging-devices connected through a common link (or through a repeater)to a single port of one or more end-stations (or any other devices).Preferably, the bridging-devices are assigned an operation order,preferably an arbitrary order. Each of the bridging-devices and theend-station continuously, at predetermined intervals, sends test framesthrough its port leading to the common link. The bridging-devicesreceive the test frames and determine when the test frames from one ormore of the devices (i.e., bridging-devices and end station) are notreceived for over a predetermined interval. When test frames arereceived from all the devices, only the bridging-device which is highestin the operation order activates its port to the common link. When adevice receives test frames from at least one bridging-device higherthan it in the operation order, it blocks its port leading to the commonlink. When a device does not receive test frames from all thebridging-devices higher than it in the operation order, it activates itsport leading to the common link.

Preferably, when a bridging-device does not receive test frames from theend-station (even if it receives test frames from the otherbridging-devices) it blocks its port to the common link. Alternatively,when the bridging-device does not receive any test frames (neither fromthe end-station nor from the other bridging-devices) it blocks its portto the common link. However, when the bridging-device receives testframes from one or more other bridging-devices it disregards the factthat it did not receive test frames from the end-station, as thereceiving of the test messages indicates that the receivingbridging-device is not at fault. Thus, at all times one port is keptopen to the end-station such that when the end-station recovers it mayimmediately transmit frames which will be received by a forwarding portof a bridging-device. In addition, if a plurality of end-stations areconnected through a single Ethernet repeater or other common link, andonly one of the end-stations transmits test messages, the otherend-stations which do not send test messages will be connected to thenetwork including the bridging-devices, even if the end-station whichtransmits the test messages is inoperative.

An aspect of some preferred embodiments of the present invention relatesto a distributed port-blocking method which operates on a networkincluding one or more partially-participating devices (e.g.,end-stations) which provide information used in determining which portsshould be blocked, but do not participate in determining which portsshould be blocked. Preferably, the one or more partially-participatingdevices do not run any software related to the port-blocking method.Preferably, the partially-participating devices send test messages toother, fully-participating, devices, only in response to responserequests generated by the fully-participating devices. The test messagessent by the partially-participating devices are preferably standardmessages which substantially every network device complying with widelyaccepted standards, can generate.

In a preferred embodiment of the present invention, the responserequests are sent to the partially-participating devices using theactual MAC addresses and/or IP addresses of the partially-participatingdevices. Preferably, the IP and/or MAC addresses of thepartially-participating devices are configured by a system manager intothe fully-participating devices. In a preferred embodiment of theinvention, the IP address is configured by a system manager and the MACaddress is determined using standard address resolution protocol (ARP)methods. Alternatively, the fully-participating devices determine theaddresses of the partially-participating devices based on normaltraffic, unrelated to the port-blocking method, generated by thepartially-participating devices.

In a preferred embodiment of the invention, the test messages sent bythe partially-participating devices and/or the response requests sent tothe partially-participating devices are sent with special addressesand/or other identifications which prevent their distribution throughoutthe network. In a preferred embodiment of the invention, the responserequests are sent as unicast address resolution protocol (ARP) messagesdirected only to a single partially-participating device. Thus, theresponse requests are not distributed throughout the network.

In some preferred embodiments of the invention, at least some of theports which should be blocked according to the port-blocking method, aremoved to an emulated blocking state in which they do not forwardmessages but they send and receive test messages and/or responserequests used by the port-blocking method.

An aspect of some preferred embodiments of the present invention relatesto a distributed port-blocking method which does not cause an,operative, active port to be blocked. When a device which was nothighest in the operation order activates its port to the common link, itcontinuously advertises that it is now the highest bridging-device inthe operation order. According to a predetermined scheme, all thebridging-devices deduce from the advertisements a new operation order. Abridging-device preferably does not activate its port before it checksthat it does not receive for a predetermined period, advertisementswhich would change its decision to activate the port. In a preferredembodiment of the invention, the advertisements are included within thetest frames transmitted by the bridging-device highest in the operationorder.

An aspect of some preferred embodiments of the present invention relatesto a port-blocking method which is based on two way software testing ofthe communication between the devices of a network. Using two waysoftware testing ensures that all malfunctions, even if they are only ina single direction, will be identified and ports will be blocked and/oractivated accordingly to form an operative tree within the network.Preferably, in addition to test frames, each device transmitsacknowledgment frames which report the receiving of the test frames. Ina preferred embodiment of the invention, the acknowledgment framestransmitted by a bridging-device are embedded within the test framestransmitted by the bridging-device. A device which does not receiveacknowledgments knows that its connection is inoperative, even if itreceives test frames. Alternatively or additionally to transmittingacknowledgment frames, each bridging-device participating in theprotocol transmits response requests to the other participatingbridging-devices. The bridging-devices transmit test frames only inresponse to the response requests. Thus, a bridging-device receiving atest message knows that the connection on which the test message wasreceived is operative in both directions.

There is therefore provided in accordance with a preferred embodiment ofthe invention, a method of managing connectivity between an end-deviceand one of a plurality of bridging-devices connected to the end-device,including transmitting test messages by each of the bridging-devices,transmitting test messages by the end-device, determining, in each ofthe bridging-devices, with which of the other devices there is anoperative connection, based on the test messages the bridging-devicereceives, and determining, in each of the bridging-devices, whether aport leading to the end-device should be in a forwarding or blockingstate responsive to the determination of the operative connections.

Preferably, the bridging-devices and end-device are connected through acommon Ethernet repeater. In a preferred embodiment of the invention, atleast one additional end-device is connected to the bridging-devicesthrough the common Ethernet repeater. Preferably, the at least oneadditional end-device may transmit or not transmit test messages.Preferably, the end-device is connected to the bridging-devices througha single port of the end-device.

Preferably, transmitting the test messages by the end-device includestransmitting the messages in response to response requests from at leastone of the bridging-devices. Preferably, transmitting the test messagesby the end-device and/or the bridging-devices includes transmitting ARPmessages. Preferably, transmitting the ARP messages by the end-deviceand/or the bridging-devices includes transmitting in response to unicastARP requests. Alternatively or additionally, transmitting the testmessages by the end-device includes transmitting ICMP echo messages.Preferably, transmitting the test messages by the bridging-devicesand/or by the end-device includes transmitting messages with BPDUdestination addresses. Preferably, transmitting the test messages by thebridging-devices includes transmitting messages which includeacknowledgments of test messages recently received from otherbridging-devices. Alternatively or additionally, transmitting the testmessages by the bridging-devices includes transmitting messages whichinclude an indication of the protocol state of the port toward theend-device of the transmitting bridging-device.

Preferably, transmitting messages which include an indication of theprotocol state of the port includes transmitting messages which includeindication on whether the port is blocking, “moving to forward” orforwarding. Preferably, determining with which of the other devicesthere is an operative connection, based on the test messages thebridging-device receives includes making the determination based onwhether the messages are received and/or based on the contents of thereceived messages.

Preferably, determining by a bridging-device with which of the otherdevices there is an operative connection includes considering a deviceas having an operative connection with the determining bridging-deviceif at least a predetermined percentage of the test messages expected tohave been transmitted by the other device, are received over apredetermined period by the determining bridging-device.

Preferably, determining by a bridging-device with which of the otherdevices there is an operative connection includes considering a deviceas having an operative connection with the determining bridging-deviceif at least one of the test messages expected to have been transmittedby the other device, are received over a predetermined period by thedetermining bridging-device. Preferably, determining with which of thedevices there is an operative connection includes considering a deviceas having an operative connection only if at least one of the testmessages received from the other device over a predetermined periodinclude acknowledgments of receiving test messages from the determiningbridging-device.

Preferably, determining whether the port should be in forwarding orblocking state includes choosing the forwarding state if the connectionwith the end-device is operative and the connection to the otherbridging-devices is inoperative or if the other bridging-devices did notchoose the forwarding state.

Preferably, the bridging-devices are organized in a predetermined orderand determining whether the port should be in the forwarding or theblocking state includes choosing the forwarding state if the connectionwith all the bridging-devices higher in the predetermined order areconsidered inoperative. Preferably, determining whether the port shouldbe in forwarding or blocking state includes choosing the forwardingstate only if no other bridging-device with operative connection to theend-device is in the forwarding state.

Preferably, the method includes moving a port which should be in theblocking state according to the determination, to an emulated blockingstate in which at least some test messages carrying destinationaddresses other than the standard STA BPDU address may be transmittedand received through the port but substantially all messages receivedthrough the port are not forwarded through any other port of thebridging-device containing the emulated blocking port. Preferably,moving the port to the emulated blocking state includes moving the portto a state in which at least some test messages carrying destinationaddresses other than the standard STA BPDU address may be transmittedand received through the port to and from the processor of thebridging-device. Alternatively or additionally, moving the port to theemulated blocking state includes moving the port to a state in whichsubstantially all messages received through other ports of thebridging-device are not forwarded through the emulated blocking state.

Alternatively or additionally, moving the port to the emulated blockingstate includes moving the port to a state in which at least some of themessages received through the emulated blocking port are not passed tothe processor. Alternatively or additionally, moving to a state in whichat least some of the messages received through the emulated blockingport are not passed to the processor includes moving the port to a statein which broadcast and multicast messages received through the port arenot passed to the processor. Alternatively or additionally, moving theport to the emulated blocking state includes moving the port to a statein which messages received through the emulated blocking port are notused in matching addresses to ports.

Preferably, moving the port to the emulated blocking state includestagging all untagged messages received by the port as belonging to aVLAN to which none of the other ports of the bridging-device belong.Further preferably, moving the port to the emulated blocking stateincludes moving the port to a state in which the emulated blocking porttransmits and receives only messages of a specific VLAN which is notsupported by any of the other ports of the bridging-device.

There is further provided in accordance with a preferred embodiment ofthe invention, a method of preventing formation of loops in a networkincluding a plurality of devices, each having one or more ports,connected by communication links, including transmitting test messagesby the plurality of devices, determining in fewer than all thetransmitting devices, which of the ports of the determining deviceshould be in the forwarding state, based on the test messages thedetermining device receives, and setting all the ports of thenon-determining transmitting devices, permanently to the forwardingstate.

Preferably, the non-determining transmitting devices include only asingle port each. Preferably, the non-determining transmitting devicesinclude end-stations. Further preferably, the non-determiningtransmitting devices do not run a software related to the loopprevention method. Preferably, transmitting test messages by thenon-determining devices includes transmitting response requests to thenon-determining devices from one or more of the determining devices andtransmitting the test messages in response to the response requests bythe non-determining devices.

Preferably, transmitting response requests includes transmitting ARPrequests, more preferably ARP requests with unicast destinationaddresses. Alternatively, transmitting response requests includestransmitting ICMP echo messages. Preferably, transmitting responserequests includes transmitting response requests with one or morespecial source addresses which do not belong to any of the devices.

Preferably, the method includes configuring the device transmitting theresponse requests with a IP address or MAC address of thenon-determining device to which the response requests are transmitted.Alternatively or additionally, the method includes determining, by thedevice transmitting the response requests, of the IP address of thenon-determining device to which the response requests are transmitted,from messages unrelated to the loop prevention method transmitted fromthe non-determining device. Preferably, the determining transmittingdevices include bridging-devices. Preferably, the method includes movingat least one of the ports to an emulated blocking state in which testmessages may be transmitted and received through the port but allmessages received through the port are not forwarded through any otherport of the device which includes the emulated blocking port.

Preferably, moving the at least one of the ports to the emulatedblocking state includes tagging all messages received by the port asbelonging to a VLAN to which none of the other ports of the devicebelong. Preferably, moving the at least one of the ports to the emulatedblocking state includes moving to a state in which the emulated blockingports transmit and receive only messages of a specific VLAN not incommon with any of the other ports of the device to which the emulatedblocking port belongs. Preferably, moving the at least one of the portsto an emulated blocking state includes moving ports which lead tonon-determining devices.

There is further provided in accordance with a preferred embodiment ofthe invention, a device of a local area network, including at least oneport through which the device sends test messages, used in determiningthe topology of the network, to one or more bridging-devices of thenetwork, and a processor which runs an IP stack but does not run asoftware of any port blocking method.

There is further provided in accordance with a preferred embodiment ofthe invention, a method of blocking ports to prevent formation of activeloops in a network, including determining topology information of thenetwork, determining whether one or more specific ports of the networkare currently active, and determining which port should be active, basedon the determined topology information and based on whether the one ormore specific ports of the network are currently active.

Preferably, determining the topology information includes transmittingtest messages between devices of the network. Preferably, determiningthe topology information includes determining whether the transmittedtest messages are received. Preferably, transmitting the test messagesincludes transmitting messages which include indication of the protocolstate of one or more of the ports of the transmitting device.

Preferably, determining the topology information includes determiningwhether the links to which the one or more ports lead, are operative. Ina preferred embodiment of the invention, determining the topologyinformation includes receiving hardware indications on the operabilitythe links to which the one or more ports lead.

Preferably, determining which port should be active includes determiningthat a first port should be active only if all the other ports leadingto the same device as the first port are not currently active.Preferably, all the ports leading to the same device as the first portare ordered in a predetermined order and determining which port shouldbe active includes determining that the first port should be active onlyif all the other ports higher than the first port in the predeterminedorder are not in a state indicating that the port is planning to beactive. Preferably, determining whether the one or more specific portsof the network are currently active includes determining by a firstdevice of the network whether at least one port of a second device ofthe network is active.

There is further provided in accordance with a preferred embodiment ofthe invention, a method of blocking ports to prevent formation of activeloops in a network, including determining topology information of thenetwork, determining one or more parameters of the network, blocking afirst group of ports responsive to the determined one or more parametersof the network and responsive to the determined topology information,changing at least one of the one or more parameters of the networkresponsive to the blocking of the first group of ports, and determiningwhether to change the group of blocked ports responsive to the changedat least one of the one or more parameters.

Preferably, determining the topology information includes determiningwhether one or more links of the network are operative. Preferably,determining the one or more parameters of the network includesdetermining weights of one or more links of the network. Preferably,changing at least one of the one or more parameters of the networkincludes changing the weight of at least one of the links of thenetwork. Preferably, changing the weight of the at least one of thelinks includes reducing the weight of at least one currently active linkof the network.

Alternatively or additionally, determining the one or more parameters ofthe network includes determining an activating priority order of aplurality of ports of the network. Preferably, changing at least one ofthe one or more parameters of the network includes changing the positionof at least one of the plurality of ports in the activating priorityorder. Preferably, changing the position of at least one of theplurality of ports in the activating priority order includes moving acurrently active port to the top of the priority order.

Preferably, determining the one or more parameters of network includestransmitting test messages between devices of the network. Preferably,transmitting the test messages includes transmitting BPDUs. Preferably,determining the one or more parameters of the network includes accessingan internal storage of the determining device.

Preferably, changing at least one of the one or more parameters of thenetwork includes reducing the number of possible operability changeswhich will change the group of blocked ports of the network by changingthe at least one of the one or more parameters of the network.

Alternatively or additionally, changing at least one of the one or moreparameters of the network includes preventing the group of blocked portsof the network from changing without a failure occurring on theconnection of an active port by changing the at least one of theparameters.

There is further provided in accordance with a preferred embodiment ofthe invention, a method of blocking ports to prevent formation of activeloops in a network, including blocking a first group of ports at a firsttime responsive to an operativeness state of the network, and blocking asecond group of ports different from the first group of ports, at asecond time, while the network is in the same operativeness state ascaused the blocking of the first group of ports.

Preferably, the operativeness state of the network includes a state inwhich substantially all the elements of the network are operative.Preferably, the method includes blocking the second group of portsresponsive to a different operativeness state of the network than causedthe blocking of the first group of ports and blocking the second groupof ports while the network is in the same operativeness state as causedthe blocking of the first group of ports includes not changing the groupof blocked ports although the operativeness state of the network changedfrom the different operativeness state to the same operativeness stateas caused the blocking of the first group of ports.

Preferably, the method includes transmitting, from a plurality ofbridging-devices of the network, test messages which include indicationof the current state of the ports of the transmitting bridging-deviceand blocking the second group of ports includes blocking the secondgroup of ports rather than the first group of ports responsive to thetransmitted test messages. Preferably, the network includes a pluralityof bridging-devices and at least some of the plurality ofbridging-devices change the state of a port from forwarding to blockingonly if the port is inoperative or suspected as being inoperative.

There is further provided in accordance with a preferred embodiment ofthe invention, a method of blocking ports to prevent formation of activeloops in a network, including transmitting messages by at least onefirst bridging-device to at least one second bridging-device of thenetwork, transmitting messages by the at least one secondbridging-device to the at least one first bridging-device responsive tothe messages from the at least one first bridging-device to the at leastone second bridging-device, and determining which ports to blockresponsive to at least the messages transmitted by the at least onesecond-bridging device received by the at least one firstbridging-device.

Preferably, transmitting messages by the at least one secondbridging-device to the at least one first bridging-device includestransmitting messages which include acknowledgments of the messages fromthe at least one first bridging-device to the at least one secondbridging-device. Preferably, transmitting messages from the at least onesecond bridging-device to the at least one first bridging-deviceincludes transmitting spanning tree algorithm BPDUs. Preferably,transmitting messages from the at least one first bridging-device to theat least one second bridging-device includes transmitting messagesbetween substantially each pair of directly linked bridging-devices inthe network. Preferably, determining which ports to block includesdetermining which ports to block, responsive to whether the messagestransmitted by the at least one second-bridging device are received.Preferably, determining which ports to block includes determining whichports to block, responsive to the contents of the messages received bythe at least one first bridging-device.

There is further provided in accordance with a preferred embodiment ofthe invention, a device of a local area network, includes a processor,and at least one port which passes to the processor at least messagesbelonging to a plurality of different protocols and which does notforward any of the messages it receives through any other port of thedevice.

Preferably, the at least one port determines which messages are passedto the processor based on the destination address of the packets and theat least one port passes to the processor messages of a plurality ofdifferent destination addresses. Preferably, the at least one portpasses to the processor messages of at least one address different fromthe standard STA BPDU address. Preferably, the at least one port doesnot forward messages received through any of the other ports of thedevice. Preferably, the at least one port does not match addresses toports. Preferably, the at least one port tags all untagged messagesreceived by the at least one port as belonging to a VLAN to which noneof the other ports of the device belong.

BRIEF DESCRIPTION OF FIGURES

The invention will be more clearly understood by reference to thefollowing description of preferred embodiments thereof in conjunctionwith the figures, in which:

FIG. 1 is a schematic illustration of a local area network, inaccordance with a preferred embodiment of the present invention;

FIG. 2 is a schematic illustration of a portion of the network of FIG.1, on which a single instance of a blocking protocol, in accordance witha preferred embodiment of the present invention, is run;

FIG. 3 is a simplified flowchart of the actions performed in a portblocking method, in accordance with a preferred embodiment of thepresent invention;

FIG. 4 is a schematic state diagram of the operation of bridging-devicescarrying out a port blocking method, in accordance with a preferredembodiment of the invention; and

FIG. 5 is a schematic illustration of a local area network, inaccordance with another preferred embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

FIG. 1 is a schematic illustration of a local area network 20, inaccordance with a preferred embodiment of the present invention. Network20 comprises a plurality of bridging-devices 22 which are used toconnect a plurality of end-stations 24 (marked in FIG. 1 as 24A, 24B,24C and 24D) to each other and/or to external networks, through one ormore backbone bridging-devices and/or routers, such as a pair ofbackbone bridging-devices which are also routers, referred to asbackbone routers 28 in FIG. 1. One or more of end stations 24 compriseonly a single port 26 which is suitable for connecting to any ofbridging-devices 22. Preferably, the ports 26 of end-stations 24 areconnected through respective Ethernet repeaters 30 to a plurality ofports 32 on different bridging-devices 22. Thus, redundancy is achievedin connecting end-stations 24 to bridging-devices 22, even though eachend-station 24 has only a single port 26. It is noted that one or moreof repeaters 30 may be replaced by common links which connect three ormore devices, such as Ethernet links.

A distributed blocking protocol, described hereinbelow, is preferablyrun separately for each end-station, e.g., 24A and 24B. Alternatively oradditionally, a plurality of end-stations, e.g., 24C and 24D, areconnected through a single repeater 30 to a plurality ofbridging-devices 22 and a single instance of the distributed blockingprotocol is run on each of the bridging-devices for the plurality ofend-stations connected through the single repeater. For each ofrepeaters 30 a software implementing the protocol is preferably run onall the bridging-devices 22 to which the repeater is connected. In somepreferred embodiments of the invention, a software implementing thedistributed protocol is run also on one or more of the end-stations 24connected to the repeater 30. In other preferred embodiments of theinvention, end-stations 24 are passive participants in the protocol, asdescribed hereinbelow. In these other embodiments, end-stations 24 donot transmit messages relating to the blocking protocol on their owninitiative and do not determine which ports should be blocked.Furthermore, in these other embodiments the software of end-stations 24is preferably not altered due to the protocol.

It is noted that the distributed blocking protocol makes a best effortto provide connection to and from the end-stations 24 at all times. Insome cases such a connection may not be possible, and externalintervening is required. Preferably, when a fault is detected in one ormore of the elements of network 20 an alert is sent to a human systemmanager, in addition to the blocking and activating of ports ofbridging-devices 22.

FIG. 2 is a schematic illustration of a portion of network 20 on which asingle instance of the blocking protocol is run, in accordance with apreferred embodiment of the present invention. For clarity, thefollowing description relates to end-station 24A and to bridging-devices22A and 22B to which end-station 24A is connected. It is noted that thesame bridging-devices 22A and 22B may run for others of their ports(which are connected to other end-stations 24), the same blockingprotocol and/or other blocking protocols, including other distributedprotocols.

Bridging-devices 22A and 22B periodically transmit test messages throughtheir respective ports 32A and 32B, which ports lead to each other andto end-station 24A. In a preferred embodiment of the invention, the testmessages are transmitted at equal time intervals at a rate of betweenabout 2-50 messages each second. Preferably, at the same or a similarrate, end-station 24A also transmits test messages through its port 26.

In some preferred embodiments of the invention, the test messages ofbridging-devices 22A and 22B, or separate messages, indicate whether thebridging-device transmitting the message has its port in a forwardingstate. These messages are preferably used when communication with bothbridging-devices 22A and 22B is operative, to determine which of thebridging-devices should activate its port 32.

FIG. 3 is a simplified flowchart of the actions performed bybridging-devices 22A and 22B in performing a port blocking method, inaccordance with a preferred embodiment of the present invention. Theflowchart of FIG. 3 ignores a few timing issues for the simplicity ofthe explanation. These issues are explained in detail furtherhereinbelow with reference to FIG. 4. The bridging-device preferablyconstantly keeps track of the test messages it receives through its port32. Periodically, for example between about 2-20 times a second,preferably every tenth of a second, the bridging-device checks whether(40) it received a sufficient number of the test messages fromend-station 24A which were (or should have been) recently sent. If itdid not receive the sufficient number of test messages from end-station24A, the bridging-device moves to a blocking state (42) as it is notsuitable for sustaining communication between network 20 and end-station24A. If the bridging-device did receive the sufficient number of testmessages from end-station 24A, the bridging-device checks (44) whetherit received a sufficient number of the test messages from the otherbridging-device. If the sufficient number of test messages were notreceived, it is concluded that the other bridging-device is inoperativeand therefore the bridging-device moves its port to a forwarding state(46).

If the sufficient number of test messages were received from the otherbridging-device as well as from the end-station, both thebridging-devices are operative. In this case one of the bridging-devicesmust block its port and the other bridging-device must have its port inforwarding state. In a preferred embodiment of the invention, thebridging-device checks (48) the contents of the test messages receivedfrom the other bridging-device to determine whether the otherbridging-device already has its port in the forwarding state. If theother bridging-device already has its port in the forwarding state, thebridging-device moves to the blocking state. Otherwise, thebridging-device moves to (or remains in) the forwarding state.Alternatively, a predetermined one of the bridging-devices is selected,and whenever both the bridging-devices are operative, the predeterminedselected bridging-device operates in the forwarding state and the otherbridging-device operates in the blocking state. Further alternatively,the bridging-device currently in the forwarding state remains in theforwarding state and only if neither of the bridging-devices were in theforwarding state (e.g., the bridging-devices were just operated), thepredetermined bridging-device moves to the forwarding state.

Alternatively to blocking port 32, as described above, any time testmessages are not received from end-station 24A (40, 42), port 32 isunconditionally blocked when test messages are not received from bothend-station 24A and from the other bridging-device 22. When testmessages are received from the other bridging-device but not fromend-station 24A, the bridging-device acts as if the test messages fromend-station 24A are received (moving to 48). Thus, at all times one ofports 32 is forwarding, such that immediately when end-station 24A isoperative it can transmit and receive messages without delay. Inaddition, in some preferred embodiments of the invention, it is desiredto connect a plurality of end-stations 24 through a single Ethernetrepeater 30 (as illustrated by end-stations 24C and 24D in FIG. 1).Preferably, in this embodiment test messages are sent only from a singleone of the end-stations, e.g., end-station 24A. Thus, using the abovedescribed alternative which always keeps one port 32 forwarding, ifend-station 24A is inoperative while the other end-station is stilloperative the communication with the operative end-station is notinterrupted.

Alternatively, when a plurality of end-stations are connected through asingle Ethernet repeater, end-stations 24 split between them thetransmission of the test messages. For example, instead of a singleend-station 24 transmitting messages at a rate of 10 per second, eachone of two end-stations transmit messages at a rate of 5 per secondalternately. Thus, even if one of the plurality of end-stations isinoperative, test messages are received by bridging-devices 22 from theother end-station.

Referring in more detail to transmitting the test messages frombridging-devices 22A and 22B, it is noted that in normal conditions, atleast one of ports 32A and 32B is blocked and therefore a scheme isrequired to allow the test messages to pass through blocked ports. In apreferred embodiment of the invention, the test messages are transmittedwith the destination address normally used for spanning tree algorithm(STA) BPDUs. Using the same destination address as used by STA BPDUs,allows entrance of the test messages through blocked ports using thestandard software of bridging-devices.

Alternatively or additionally, the software of the bridging-devices ischanged to define an emulated blocking state, in which test messages areallowed to enter through the port to the processor of thebridging-device while other frames received through port 32 are notforwarded through any of the ports of the bridging-device. In apreferred embodiment of the invention, the test messages are sent usingthe MAC destination addresses of the bridging-devices. Alternatively oradditionally, the test messages are sent using special dedicated MACaddresses used substantially only for the test messages. Preferably,each of bridging-devices 22A and 22B is assigned a separate dedicatedMAC address. Alternatively, a single dedicated MAC address is used forboth of bridging-devices 22A and 22B;

In some preferred embodiments of the invention, the test messages have aspecial message format used substantially only for the test messages.Alternatively, the test messages have a known format, such as an ARPquery format or a ping format.

Referring in more detail to transmitting the test messages fromend-station 24A, in a preferred embodiment of the invention, theend-station transmits the test messages based on an internal timingwithin it. In some preferred embodiments of the invention, the testmessages from end-station 24A are sent with the MAC address of STA BPDUsor a dedicated address as described above with relation to the testmessages from bridging-devices 22.

Alternatively, in order to avoid changing the software of end-station24A, the transmission of test messages by end-station 24A is performedusing a polling method. That is, bridging-devices 22A and 22Bperiodically, at a desired rate, send response requests to end-station24A and the end-station sends its test messages responsive to theresponse requests. In a preferred embodiment of the invention,bridging-devices 22A and 22B send response requests at the rate theysend their test messages, such that each of bridging-devices 22A and 22Breceives from end-station 24A response messages directed to it at therate it receives test messages from the other bridging-device. In thisembodiment, however, end-station 24 sends test messages (responsemessages) at twice the rate bridging-devices 22A and 22B send testmessages. Alternatively, bridging-devices 22A and 22B send the responserequests at about half the rate at which they send test messages, sothat end-station 24A sends test messages at the same rate asbridging-devices 22. Further alternatively, only one of thebridging-devices sends response requests and the other bridging-devicesends response requests only if it does not receive test messages fromend-station 24A.

In a preferred embodiment of the invention, a system manager configuresthe bridging-devices with the MAC address and the IP address of theend-stations 24 for which the bridging-devices run the port blockingmethod. Alternatively, the system manager configures thebridging-devices with the IP address of the end-stations 24, and thebridging-devices determine the respective MAC addresses of theconfigured IP addresses using standard ARP methods. The determination ofthe MAC address is preferably performed when the bridging-device isactivated and/or when the communication between one or more of theend-stations and the bridging-device is disconnected for a long time.The determination of the MAC address after a long disconnection isperformed in order to check whether the MAC address of the end-station24 with which there was no connection for a long time, has changed.Further alternatively, the bridging-devices determine both the IPaddress and the MAC address of end-stations 24 from the data frameswhich the end-station creates and transmits.

It is noted that in many cases it is desirable to allow a user toconnect an end-station 24A to network 20 without needing to change thesoftware of the end-station. In addition, the software of end-station24A may be complicated or inaccessible for changes, as it is not alwaysproduced by the same manufacturer as bridging-devices 22.

In a preferred embodiment of the invention, the response requests of theabove described polling method comprise ping messages, i.e., Internetcontrol message protocol (ICMP) echo messages. Alternatively oradditionally, the response requests comprise address resolution protocol(ARP) queries. Preferably, in either of these alternatives, when theports of the bridging-devices are supposed to be blocked they are set toan emulated blocking state, which allows the response requests and theresponses to be transmitted and received through the blocked port.

In a preferred embodiment of the present invention, the responserequests are sent with the unicast address of end-station 24A as theirdestination address, so that the response requests do not propagatethrough the network unnecessarily. Preferably, all of thebridging-devices 22 connected through repeater 30 to end-station 24Arecognize the address of end-station 24A, such that the bridging-device22 which has its port in the forwarding state will not forward theresponse requests throughout the network as if they are unknown unicastmessages.

In a preferred embodiment of the present invention, bridging-devices 22use a special dedicated address, different from the regular addresses ofthe bridging-devices, to identify themselves in their port-blockingrelated communication with end-station 24A. In embodiments in which thetest messages sent between bridging-devices 22 use special dedicatedaddresses, these addresses may be the same or different than theaddresses used for the communication with end-station 24A. The specialdedicated address is preferably used as the source address of theresponse requests sent to end-station 24A such that the consequentrequest responses (i.e., the test messages sent by end-station 24A) aresent to the special dedicated address. The use of the dedicatedaddresses allows differentiation between test messages related to theport-blocking method and other messages sent to a bridging-device 22.

In a preferred embodiment of the present invention in which eachrepeater 30 is connected to two bridging-devices 22, two dedicatedaddresses are used for the communication with end-stations 24,throughout network 20. Preferably, the two dedicated addresses are usedfor each repeater 30 to differentiate between the bridging-devicesconnected to the same repeater. Preferably, when more than twobridging-devices 22 are connected to a single repeater 30, eachbridging-device is assigned a separate dedicated address. It is notedthat a single bridging-device 22 may be assigned different dedicatedaddresses for the different reporters to which it is connected.

Referring in more detail to checking whether test messages are receivedfrom the other bridging-device 22 and/or from end-station 24A (40 and/or44), in a preferred embodiment of the invention, the bridging-devicechecks whether the sufficient number of test messages are receivedduring a predetermined period. In a preferred embodiment of theinvention, the predetermined period has a length of between about0.2-0.8 seconds, most preferably about 0.5 seconds. Alternatively, thepredetermined period is of the length of time between two consecutivetimes in which the bridging-device checks whether it received asufficient number of the test messages. In a preferred embodiment of thepresent invention, the sufficient number of messages comprises onemessage, such that if a single message is received the connection isconsidered operative. Alternatively, the sufficient number of messagescomprises all the transmitted messages. Further alternatively, thesufficient number of messages comprises a certain percentage of thetransmitted messages, such as 50% or 75% of the transmitted messages. Insome preferred embodiments of the present invention, differentpercentages of required received messages are defined for differentconnections, e.g., the connection between bridging-device 22 andend-station 24A versus the connection between bridging-devices 22.

As described above, in a preferred embodiment of the invention, aplurality of end-stations 24 are connected to bridging-devices 22through a single Ethernet repeater 30, and the test messages are sentalternately by the plurality of end-stations. Preferably, in thisembodiment, the test messages from end-stations 24 are consideredreceived if a sufficient percentage of all the expected transmittedmessages, are received. Alternatively, the test messages are consideredreceived properly, if a sufficient percentage of all the test messagesexpected to have been transmitted from all the end-stations connectedthrough the repeater 30, are received.

In a preferred embodiment of the invention, bridging-devices 22A and 22Binclude acknowledgment indications of the test messages they received inthe test messages they transmit. Alternatively, bridging-devices 22A and22B transmit separate acknowledgment messages responsive to the testmessages they receive. Preferably, a link is considered operative onlyif a sufficient percentage of acknowledgment messages are received inaddition to the test messages. In a preferred embodiment of the presentinvention, a single acknowledgment message is sufficient even if morethan one test messages are required for a link to be consideredoperative. Alternatively, each received test message must have arespective acknowledgment message (included within or receivedseparately) in order for the link to be considered operative. Thus, if alink is inoperative in one direction it will be considered inoperativeas the acknowledgment messages will not be received. Alternatively, thetest messages are transmitted by bridging-devices 22A and 22B responsiveto response requests generated by the other of the bridging-devices.

Preferably, the response messages generated by end-station 24A identifythe bridging-device 22 which sent the response request that initiatedthe generation of the response message. Preferably, the messagesidentify the initiating bridging-device by stating one of the pluralityof dedicated addresses which differentiate between the bridging-devicesconnected to a single repeater 30. Alternatively, the messages use adestination MAC address unique to the initiating bridging-device.Preferably, a bridging-device considers the connection with end-station24A operative, only if response messages generated responsive to theresponse requests of the bridging-device, are received. Thus, thebridging-device knows that the communication with end-station 24A isoperative in both directions.

In a preferred embodiment of the invention, the response requeststransmitted by bridging-devices 22 to end-station 24A and the testmessages transmitted by bridging-devices 22 are included in a singlecommon message. Preferably, the common message is transmitted using theSTA BPDU destination address, such that the common message does notpropagate throughout the network.

Referring in more detail to the step of moving to the forwarding state(46), preferably the bridging-device waits a short period before movingits port 32 into the forwarding state. The short period is preferably asufficient time for the other bridging-device to block its port 32. Thisis performed in order to make sure that one bridging-device will notmove its port 32 to the forwarding state while the other bridging-devicehas its port 32 in the forwarding state.

As described above, a port in the emulated blocking state preferablyallows test messages to be transmitted and received through the port,but messages received through the port are not forwarded through any ofthe other ports of the bridging-device containing the emulated blockingport. In addition the emulated blocking port preferably does not forwardmessages received by any of the other ports of the bridging-devicecontaining the emulated blocking port.

In a preferred embodiment of the invention, the emulated blocking portis created by tagging all the untagged (i.e., not marked as belonging toa VLAN) frames received through the emulated blocking port as belongingto a predefined VLAN which is not supported by any of the other ports ofthe bridging-device. In a preferred embodiment of the invention, thetagging comprises internal tagging which is used only by the taggingbridging-device. Alternatively, the tagging comprises external taggingwhich takes effect also outside of the bridging-device if the messageexits the bridging-device.

Preferably, if the bridging-device has a plurality of emulated blockingports, each of the ports tags the frames it receives as belonging to adifferent VLAN. Messages which are already tagged as belonging to aspecific VLAN are preferably received by the port only if they aretagged with the VLAN of the port. Thus, frames received by the emulatedblocking port are not forwarded through any other port.

In addition, the emulated blocking port is preferably configured toforward out of the bridging-device only messages tagged as belonging tothe predefined VLAN, such that substantially all messages received byany of the other ports of the bridging-device are not forwarded throughthe emulated blocking port.

Alternatively or additionally, the test messages (including responserequest frames and the responses to the response requests) directed tothe emulated blocking port are tagged as belonging to the VLAN of theport. Preferably, the port transmits and/or receives only frames of thedefined VLAN.

In a preferred embodiment of the invention, the emulated blocking portis configured to pass to the processor of the bridging-device onlyreceived frames which carry test messages. Preferably, the framescarrying test messages are identified based on their destination addresswhich is, as described above, either the MAC address of thebridging-device or a dedicated unicast address defined specifically forthe test messages, or by some other identification within the frames.Specifically, the emulated blocking port is preferably configured not topass multicast, broadcast and/or unknown unicast messages to theprocessor. By preventing the frames reaching the emulated blocking portfrom being passed to the processor, the load on the processor of thebridging-device is kept substantially at the level as it would be if theport was in a real blocking state.

Referring back to FIG. 1, it is noted that some frames, e.g., broadcastframes, sent to and from end-station 24A may be received bybridging-device 22B twice. Assuming, without loss of generality, thatthe port 32 of bridging-device 22B leading to end-station 24A iscurrently blocked, the frames are received once through a port 34connected to one of backbone routers 28 which received the frame frombridging-device 22A which in turn has a forwarding port 32 connected tothe repeater 30 leading to end-station 24A. The same frame is alsoreceived through Ethernet repeater 30 and the emulated blocking port 32.Therefore, in bridging-devices 22 which learn a single port for eachaddress, the bridging-device will alternately learn that the end-stationtransmitting the frames is behind the blocking and active ports. Suchlearning will confuse bridging-device 22 and will slow down theoperation of network 20. In bridging-devices which performMAC-address-to-port mapping for each VLAN separately, thebridging-device will learn a plurality of ports for each MAC address inmessages the bridging-device receives. One learned port will be thecorrect port and the rest will be one or more emulated blocking ports.If there are many devices connected through repeaters and many deviceswith addresses in the network, the memory of the bridging-device may beexhausted and messages received by the emulated blocking ports mayinitiate learning of unnecessary mappings which will overwrite necessarymappings from forwarding ports.

Therefore, in a preferred embodiment of the invention, thebridging-device is configured not to perform automaticMAC-address-to-port mapping based on frames received through theemulated blocking port. It is noted that in some preferred embodimentsof the invention it is not possible to configure the bridging-device notto perform MAC-address-to-port mapping for a single port 32. Preferably,in these embodiments the bridging-device is configured not to performautomatic MAC-address-to-port mapping for a group of ports to whichports 32 belong. Preferably, instead of performing the automaticMAC-address-to-port mapping, the bridging-device periodically sends ARPmessages to the end-stations 24 to which it is connected to determinethrough which port they are connected. Preferably, the ARP messages aretransmitted between about every 10-20 seconds. Further preferably, thosedevices to which ARP messages are sent as test messages, as describedabove, are not sent additional ARP messages for performingMAC-address-to-port mapping and rather the information from the testmessages is used. Preferably, only end-stations 24 for which the portblocking method of the present invention is performed, are connected tothe group of ports of bridging-device 22 which includes ports 32.

It is noted that in some preferred embodiments of the present invention,network 20 provides services for one or more virtual servers. Thevirtual server is assigned an IP address and/or a MAC address which areused in the messages sent to the virtual server. Messages directed tothe virtual server are passed to one of end-stations 24 currentlyassigned to handle the messages to the virtual server. The assignedend-station of the virtual server at any specific time is preferablychosen by end-stations 24 according to the operativeness state ofend-stations 24. Preferably, the port mapping of the addresses of thevirtual server is performed by periodically polling the ports behindwhich the virtual server may be, to find out where the server iscurrently located (i.e., which end-station is handling messagesaddressed to the virtual server). Alternatively or additionally, theend-station 24 practicing for the virtual server periodically sendsmessages to bridging-devices 22 notifying them that it is currentlypracticing for the virtual server, such that the bridging-devices 22 caneasily perform the port mapping for the virtual server. Furtheralternatively or additionally, when an end-station begins to practicefor the virtual server it immediately sends one or more messages tobridging-devices 22 notifying them that it is currently practicing forthe virtual server. The port learning is thus performed immediately upona change in the identity of the end-station 24 practicing for thevirtual server.

Alternatively to disabling the automatic MAC-address-to-port mapping,the processor of the bridging-device is notified each time one of theports performs learning for an address. If the learned port seemscorrect to the processor, i.e., it is not an emulated blocking port, theprocessor changes the learned entry to a static state which does notallow learning for that MAC address any more. When a change in thetopology of the network occurs, the bridging-device preferably releasesall the entries from the static state to allow learning responsive tothe new topology.

FIG. 4 is a schematic state diagram of the operation of bridging-devices22A and 22B, in accordance with a preferred embodiment of the presentinvention. When any of bridging-devices 22A and 22B is activated, thebridging-device moves from an inactive state (50) to an initializationstate “InitState” (52). In the InitState, port 32 (FIG. 2) of thebridging-device is kept in the emulated blocking state. In all statesexcept the inactive state (50), test messages are transmitted asdescribed hereinabove with reference to FIG. 3. The test messagestransmitted by bridging-devices 22A and 22B preferably include anindication of the current state of the port 32 of the transmittingbridging-device.

Preferably, all state transitions in FIG. 4 which occur when testmessages are not received from the other bridging-device, are performedonly after messages are not received for a predetermined interval. Thisinterval is required in order to make sure that state movement is notdue to a single lost packet, but rather is due to a real fault. In apreferred embodiment of the invention, the predetermined interval isbetween about 0.2-0.8 seconds, preferably 0.5 seconds. State transitionswhich occur when test messages are received from the otherbridging-device 22 preferably occur immediately as the state of theother bridging-device is known from the received test messages.Alternatively, substantially all the transitions are performed onlyafter examining messages (received or not received) during thepredetermined interval.

If the response messages from end-station 24A (referred to in FIG. 4 asARP_resp) are not received and the test messages from the otherbridging-device 22 (referred to in FIG. 4 as Hello_resp) are notreceived for at least the predetermined interval, the bridging-devicemoves to a blocking (Block) state (54). If the response messages fromend-station 24A are received and the test messages from the otherbridging-device 22 are not received for at least the predeterminedinterval, the bridging-device moves to a MovToFwd state (56) in whichthe bridging-device prepares itself to move to a Forward state (58). Inthe MovToFwd state (56) the port 32 of the bridging-device is, however,still blocked so that a case in which both ports 32A and 32B areforwarding never occurs. A bridging-device 22A or 22B moves to theForward state (58) only after it is determined (either directly from thetest messages of the other bridging-device or indirectly, as describedin detail further hereinbelow) that the other bridging-device is notmoving to the Forward state (58). If in the InitState (52), testmessages are received from the other bridging-device, regardless ofwhether response messages are received from end-station 24A, the stateto which the bridging-device moves is determined based on the stateadvertised by the other bridging-device in the test messages it sends.If the other bridging-device advertises it is not in Forward state (58),e.g., the current bridging-device is A and the other bridging-device Bis not in the forward state (B˜fwd), the current bridging-device movesto MovToFwd state (56). If the other bridging-device advertises that itis in the forward state the current bridging-device moves to blockingstate (54).

Preferably, one of the bridging-devices (22A in FIG. 4) is defined as adominant bridging-device which moves its port 32A (FIG. 2) to forwardingwhen the operation status of both the bridging-devices is equal (e.g.,both the bridging-devices operate properly) and neither of thebridging-devices is already in the forwarding state (e.g., thebridging-devices were just switched on).

A bridging-device moves (after the predetermined interval) from MovToFwdstate (56) to Forward state (58) if test messages are not received fromthe other bridging-device, which means the other bridging-devicerealizes it is inoperative and moves to the blocking state. In apreferred embodiment, the bridging-device moves to Forward state (58)only if it receives test messages from end-station 24A. Alternatively,if all other conditions are fulfilled a bridging-device may move toForward state (58) even if it does not receive test messages fromend-station 24A. In addition, if the current bridging-device is dominantit moves its port 32 to Forward state (58), if the other bridging-deviceis not advertising it is in the Forward state, even if it advertises itis in the MovToFwd state (56). If the current bridging-device is not thedominant bridging-device it moves to the forwarding state only if theother bridging-device does not advertise that it is in the forwardingstate or in the MovToFwd state.

Preferably, a bridging-device must wait in the MovToFwd state (56) for aminimal amount of time, e.g., half a second, before it moves to Forwardstate (58) to prevent both of bridging-devices 22 from moving togetherinto the forwarding state.

A bridging-device in MovToFwd state (56) which receives test messagesfrom the other bridging-device stating that the other bridging-device isin the Forward state, or is dominant and is in the MovToFwd state (56),moves to blocking state (54). In addition, a bridging-device which is inMovToFwd state (56) or Forward state (58) and does not receive testmessages both from the other bridging-device and from end-station 24Amoves to blocking state (54), after the predetermined interval, as thebridging-device must have been disconnected.

Preferably, if the non-dominant bridging-device is in Forward state (58)and receives a message from the dominant bridging-device that it is inthe Forward state (58), the non-dominant bridging-device moves toblocking state (54). It is noted that this situation should never occurand is defined only as a precaution.

A bridging-device moves from blocking state (54) to MovToFwd state (56),if it receives test messages from end-station 24A but not from the otherbridging-device or if it receives test messages stating that the otherbridging-device is in blocking state (54).

Referring back to FIG. 1, in a preferred embodiment of the invention,bridging-devices 22 and backbone routers 28 also transmit to each othertest messages used to determine which of the ports leading to backbonerouters 28 should be blocked in each of bridging-devices 22. At any timeeach bridging-device 22 preferably has only a single active port leadingto a backbone router 28. Preferably, the active port is chosen fromthose ports through which test messages indicating that the connectionwith the backbone router 28 on the other side of the port, is operative.Preferably, the test messages include acknowledgment messages, asdescribed hereinabove, such that the operativeness determination is atwo-way determination. Preferably, the active port is chosen as theoperative port which is highest in a predetermined order of the ports.In a preferred embodiment of the invention, when a port becomes activeit is moved to the top of the predetermined order. Alternatively, anactive port is not blocked unless it becomes inoperative, even if a porthigher than the active port in the predetermined order becomes active.

Alternatively, a spanning tree algorithm (STA), such as the 802.IDstandard STA is run on bridging-devices 22 and on backbone routers 28 toprevent formation of loops within network 20.

In some preferred embodiments of the present invention, an end-station24 is connected to more than two bridging-devices 22. Preferably, thebridging-devices are organized in a predetermined order. In a preferredembodiment of the present invention, the predetermined order is chosenarbitrarily. Alternatively, the predetermined order is chosen accordingto the robustness of the bridging-devices, such that bridging-deviceswhich are less likely to fail are higher in the predetermined order. Abridging-device moves its port to the forwarding state if it does notreceive test messages from all the bridging-devices higher than it inthe predetermined order. In a preferred embodiment of the presentinvention, a bridging-device which is not highest in the predeterminedorder, which sets its port 32 to the forwarding state advertises in itstest messages or in separate messages that it is currently forwarding.In some preferred embodiments of the invention, a bridging-device doesnot move to forwarding even if it is highest in the predetermined orderif it receives messages from another bridging-device which advertisethat it is currently in the forwarding state.

Preferably, when there are more than two bridging-devices 22 connectedto a single end-station 24, the bridging-devices send test messageswhich include a list of all the bridging-devices from which testmessages were recently received. Alternatively, test messages aretransmitted between each pair of bridging-devices irrespective of theother bridging-devices.

It is noted that the present invention is not limited to use withend-stations 24 which include only a single port 26 (FIG. 1). Rather,the present invention may be used also with end-stations with aplurality of ports 26, for example when it is not feasible or desired tochange the software of the end-station.

FIG. 5 is a schematic block diagram of a network with an end-stationwhich has a plurality of ports connected for redundancy to a pluralityof bridging-devices 22, in accordance with a preferred embodiment of thepresent invention. End-station 24 is connected to a plurality ofbridging-devices 22 through a plurality of respective ports 26.End-station 24, however, does not block any of ports 26 and the blockingis performed by bridging-devices 22, substantially as describedhereinabove. The blocking is preferably performed in order to preventend-station 24 from receiving broadcast messages a plurality of times,i.e., through each of its ports. Preferably, end-station 24 knows whichof its ports leads to a forwarding state, such that messages whosetransmission is initiated by the end-station are transmitted through aport which leads to a forwarding port of a bridging-device 22.Alternatively, end-station 24 transmits messages it initiates throughall its ports.

Preferably, each bridging-device sends to the end-station separateresponse requests through its respective port 26, and accordinglyreceives test messages (response requests) from end-station 24. Inaddition, each bridging-device 22 sends the other bridging-device 22test messages which arrive at the other bridging-device through one aplurality of backbone routers 28. The determination of which port is tobe blocked and which is to be forwarding is preferably performed asdescribed above with relation to FIGS. 3 and 4. It is noted, however,that unlike the embodiment described with relation to FIG. 2, thereceiving of test messages from end-station 24 by a bridging-device isonly indicative of the operation of the link connecting thebridging-device and end-station 24 and not of the connections betweenend-station 24 and other bridging-devices. Preferably, the connectionbetween bridging-devices 22 is robust, e.g., includes sufficientredundancy, such that when messages are not received by one of thebridging-devices from the other bridging-device it may be assumed thatthe other bridging-device is inoperative.

In some preferred embodiments of the present invention, a spanning treealgorithm (STA) method which involves transmitting Bridge Protocol dataUnits (BPDUs) to neighboring bridging-devices, i.e., bridging-devicesconnected to each other through a single link, is modified to verifythat all the links in the chosen tree allow two way communication. SuchSTA methods include, for example, the standard 802. ID STA, the STAsdescribed in the above mentioned documents by M. Seaman, and the STAdescribed in patent application Ser. No. 09/061,484 to Lior Shabtay,titled “Apparatus and method for Managing Communication Networks”. In apreferred embodiment of the invention, BPDUs being sent to abridging-device from which a BPDU was received, are sent withacknowledgment of reception of the BPDU. Preferably, in determining thespanning tree, only BPDUs which include acknowledgments are taken intoaccount.

Alternatively, BPDUs are transmitted only responsive to BPDU requests.Each bridging-device which desires to receive BPDUs sends BPDU requeststo its neighbors from which it wants to receive BPDUs. Thus, all theBPDUs a bridging-device receives are indicative of two way communicationbetween the bridging-device and the neighbors from which the BPDUs arereceived.

It is noted that similar variations may be performed in anyport-blocking protocol which uses transmission of test messages to checkthe operability of links. Such test messages may contain information,such as information on the topology of the network, as carried bystandard STA BPDUs, and/or one or more network parameters (e.g., weightsof links of the network, an order of priority in activating ports).Alternatively, the test messages may serve solely for determiningwhether the link is operative and carry no information.

In some preferred embodiments of the present invention, STAs which arebased on link weights, lower the link weights of links which arecurrently forwarding. Thus, when a link which was forwarding and wasblocked because it became inoperative becomes operative again it doesnot necessarily move back to the forwarding state. Preventing the linkfrom becoming forwarding again reduces the number of transitions in thespanning tree of the network, which transitions may interrupt theoperation of the network.

In a preferred embodiment of the present invention, the extent to whichthe weights of the links are lowered reflects a tradeoff between thedesire to prevent unnecessary transitions and the desire to preventpermanent use of slow and/or expensive backup links. In a firstexemplary embodiment, the weights are reduced only by a marginal amountto prevent transitions only between routes of substantially equalconditions. In a second exemplary embodiment, the weights are reducedsubstantially to a lowest allowed value to prevent transitions atsubstantially any cost.

Preferably, the change of the weights of the links is performed bytransmitting a message to all the bridging-devices connected to the link(it is noted that more than two bridging-devices may connect through asingle link) stating the new weight of the link. Preferably, the messageis transmitted from a bridging-device which activates its port to thelink, knowing that other ports to the link are activated, i.e., abridging-device which activates a port which was chosen as a root port.

In a preferred embodiment of the present invention, when the link isblocked the weight of the link is moved back up to its original weight.Alternatively or additionally, the weights of links which fail areraised beyond their original weights according to the number of timesthey failed under the assumption that the cost of using links whichcommonly fail is high.

Another method which prevents unnecessary transitions involves creatinga spanning tree by having each bridging-device begin at start-up as aseparate cluster and having the clusters attempt to combine to eachother. Each bridging-device of a cluster preferably keeps track of thetopology of the entire cluster. If there exist operative links tobridging-devices outside of a cluster, the bridging-devices of thecluster search for the shortest (lowest cost) path to an externalcluster, and the clusters combine by activating the link which connectsthem and exchanging topology information. This method, in someembodiments, does not attempt to reduce the cost of the spanning treewithin a cluster, once a spanning tree is chosen and activated.Therefore, absent a failure of an active link, in these embodiments, themethod does not change the group of blocked ports. This method isdescribed in detail in the above mentioned Ser. No. 09/061,484 U.S.patent application.

It is noted that the term bridging-device is not limited to any specificbridging-device but rather includes switches, switch modules, bridges,and any other entity which performs data transfer at layer 2 (data linklayer) of the OSI model. The bridging-devices are preferably implementedpartially in hardware although also bridging-devices implementedentirely in software are within the scope of the present invention. Inaddition, the term bridging-device includes devices which perform tasksbelonging to more than one layer of the OSI model. Such devices maybelong primarily to layers other than layer 2 of the OSI model, andperform bridging between their ports in addition to their primaryfunctions (e.g., routers of layer 3). In addition, such devices may bedirected equally to tasks of more than one layer (e.g., layer 3switches).

It will be appreciated that the above described methods may be varied inmany ways, including, changing the order of steps, and the exactimplementation used. It should also be appreciated that the abovedescribed description of methods and apparatus are to be interpreted asincluding apparatus for carrying out the methods and methods of usingthe apparatus.

The present invention has been described using non-limiting detaileddescriptions of preferred embodiments thereof that are provided by wayof example and are not intended to limit the scope of the invention. Itshould be understood that features and/or steps described with respectto one embodiment may be used with other embodiments and that not allembodiments of the invention have all of the features and/or steps shownin a particular figure or described with respect to one of theembodiments. Variations of embodiments described will occur to personsof the art. Furthermore, the terms “comprise,” “include,” “have” andtheir conjugates, shall mean, when used in the claims, “including butnot necessarily limited to.” The scope of the invention is limited onlyby the following claims:

1. A device of a local area network, comprising: at least one portthrough which the device sends test messages, used in determining thetopology of the network, to one or more bridging-devices of the network;and a processor which runs an IP stack but does not run a software ofany port blocking method.
 2. A method of blocking ports to preventformation of active loops in a network, comprising: determining topologyinformation of the network; determining whether one or more specificports of the network are currently active; and determining which portshould be active, based on the determined topology information and basedon whether the one or more specific ports of the network are currentlyactive.
 3. A method according to claim 2, wherein determining thetopology information comprises transmitting test messages betweendevices of the network.
 4. A method according to claim 3, whereindetermining the topology information comprises determining whether thetransmitted test messages are received.
 5. A method according to claim3, wherein transmitting the test messages comprises transmittingmessages which include indication of the protocol state of one or moreof the ports of the transmitting device.
 6. A method according to claim2, wherein determining the topology information comprises determiningwhether the links to which the one or more ports lead, are operative. 7.A method according to claim 6, wherein determining the topologyinformation comprises receiving hardware indications on the operabilitythe links to which the one or more ports lead.
 8. A method according toclaim 2, wherein determining which port should be active comprisesdetermining that a first port should be active only if all the otherports leading to the same device as the first port are not currentlyactive.
 9. A method according to claim 8, wherein all the ports leadingto the same device as the first port are ordered in a predeterminedorder and wherein determining which port should be active comprisesdetermining that the first port should be active only if all the otherports higher than the first port in the predetermined order are not in astate indicating that the port is planning to be active.
 10. A methodaccording to claim 2, wherein determining whether the one or morespecific ports of the network are currently active comprises determiningby a first device of the network whether at least one port of a seconddevice of the network is active.
 11. A method of blocking ports toprevent formation of active loops in a network, comprising: determiningtopology information of the network; determining one or more parametersof the network; blocking a first group of ports responsive to thedetermined one or more parameters of the network and responsive to thedetermined topology information; changing at least one of the one ormore parameters of the network responsive to the blocking of the firstgroup of ports; and determining whether to change the group of blockedports responsive to the changed at least one of the one or moreparameters.
 12. A method according to claim 11, wherein determining thetopology information comprises determining whether one or more links ofthe network are operative.
 13. A method according to claim 11, whereindetermining the one or more parameters of the network comprisesdetermining weights of one or more links of the network.
 14. A methodaccording to claim 13, wherein changing at least one of the one or moreparameters of the network comprises changing the weight of at least oneof the links of the network.
 15. A method according to claim 14, whereinchanging the weight of the at least one of the links comprises reducingthe weight of at least one currently active link of the network.
 16. Amethod according to claim 11, wherein determining the one or moreparameters of the network comprises determining an activating priorityorder of a plurality of ports of the network.
 17. A method according toclaim 16, wherein changing at least one of the one or more parameters ofthe network comprises changing the position of at least one of theplurality of ports in the activating priority order.
 18. A methodaccording to claim 17, wherein changing the position of at least one ofthe plurality of ports in the activating priority order comprises movinga currently active port to the top of the priority order.
 19. A methodaccording to claim 11, wherein determining the one or more parameterscomprises transmitting test messages between devices of the network. 20.A method according to claim 19, wherein transmitting the test messagescomprises transmitting BPDUs.
 21. A method according to claim 11,wherein changing at least one of the one or more parameters of thenetwork comprises reducing the number of possible operability changeswhich will change the group of blocked ports of the network by changingthe at least one of the one or more parameters of the network.
 22. Amethod according to claim 11, wherein changing at least one of the oneor more parameters of the network comprises preventing the group ofblocked ports of the network from changing without a failure occurringon the connection of an active port by changing the at least one of theparameters.
 23. A method of blocking ports to prevent formation ofactive loops in a network, comprising: blocking a first group of portsat a first time responsive to an operativeness state of the network; andblocking a second group of ports different from the first group ofports, at a second time, while the network is in the same operativenessstate as caused the blocking of the first group of ports.
 24. A methodaccording to claim 23, wherein the operativeness state of the networkcomprises a state in which substantially all the elements of the networkare operative.
 25. A method according to claim 23, comprising blockingthe second group of ports responsive to a different operativeness stateof the network than caused the blocking of the first group of ports andwherein blocking the second group of ports while the network is in thesame operativeness state as caused the blocking of the first group ofports comprises not changing the group of blocked ports although theoperativeness state of the network changed from the differentoperativeness state to the same operativeness state as caused theblocking of the first group of ports.
 26. A method according to claim23, comprising transmitting, from a plurality of bridging-devices of thenetwork, test messages which include indication of the current state ofthe ports of the transmitting bridging-device and wherein blocking thesecond group of ports comprises blocking the second group of portsrather than the first group of ports responsive to the transmitted testmessages.
 27. A method according to claim 23, wherein the networkincludes a plurality of bridging-devices and wherein at least some ofthe plurality of bridging-devices change the state of a port fromforwarding to blocking only if the port is inoperative or suspected asbeing inoperative.
 28. A device of a local area network, comprises: aprocessor; and at least one port which passes to the processor at leastmessages belonging to a plurality of different protocols and which doesnot forward any of the messages it receives through any other port ofthe device.
 29. A device according to claim 28, wherein the at least oneport determines which messages are passed to the processor based on thedestination address of the packets and wherein the at least one portpasses to the processor messages of a plurality of different destinationaddresses.
 30. A device according to claim 29, wherein the at least oneport passes to the processor messages of at least one address differentfrom the standard STA BPDU address.
 31. A method according to claim 28,wherein the at least one port does not forward messages received throughany of the other ports of the device.
 32. A device according to claim28, wherein the at least one port does not match addresses to ports. 33.A device according to claim 28, wherein the at least one port tags alluntagged messages received by the at least one port as belonging to aVLAN to which none of the other ports of the device belong.